From 452bab6a1bbc44e1b7b34d209cc44dba0054c9fa Mon Sep 17 00:00:00 2001
From: JSLMPR <tera1000@gmx.de>
Date: Fri, 24 Jul 2026 15:13:29 +0200
Subject: [PATCH] Add Dockerfile + .dockerignore (app image; models mounted at
 runtime)

Multi-stage build (maven:3.9-temurin-21 -> eclipse-temurin:21-jre): builds the jar,
installs ffmpeg, runs as a non-root user. The large, non-commercially-licensed AI
models and Python venv are deliberately NOT baked in -- mount them read-only at
runtime; REST/folder workflows need no models. .dockerignore keeps generated media,
models, and local state out of the build context.

Not build-validated in this environment (no running Docker daemon); the file is a
standard reviewable artifact and a starting point -- no-egress operation, scanning,
and further hardening remain to be validated.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MPuJXQyAeWpFcTtcnxo1UN
---
 .dockerignore | 18 ++++++++++++++++++
 Dockerfile    | 38 ++++++++++++++++++++++++++++++++++++++
 2 files changed, 56 insertions(+)
 create mode 100644 .dockerignore
 create mode 100644 Dockerfile

diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..1cd8a93
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,18 @@
+# Keep the build context small and never ship generated media, models, or local state.
+target/
+output/
+input/
+tmp/
+models/
+.venv-local-asset/
+.git/
+.github/
+.claude/
+*.log
+*.mp4
+*.wav
+*.onnx
+*.pt
+*.bin
+*.safetensors
+docs/
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..c35d7d6
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,38 @@
+# Multi-stage build for the video-editing service.
+#
+# The image contains the application + ffmpeg only. The local AI models (Piper, MusicGen, AudioLDM2,
+# moondream2) and their Python runtime are large and non-commercially licensed, so they are NOT baked in:
+# mount them read-only at runtime (e.g. -v $PWD/models:/app/models -v $PWD/.venv-local-asset:/app/.venv-local-asset)
+# and point the localpoc config at them. The REST clipping and folder workflows need no models.
+#
+# NOTE: this is a starting deployment artifact, not a certified production image — no-egress operation,
+# non-root hardening beyond the below, and vulnerability scanning are still to be validated.
+
+# --- build ---------------------------------------------------------------------------------------------
+FROM maven:3.9-eclipse-temurin-21 AS build
+WORKDIR /build
+# Cache dependencies first for faster rebuilds.
+COPY pom.xml .
+RUN mvn -B -ntp -q dependency:go-offline
+COPY src ./src
+# Tests run in CI (they need ffmpeg); skip them here to keep the image build fast and hermetic.
+RUN mvn -B -ntp -q -DskipTests package \
+    && cp target/video-editing-*.jar /build/app.jar
+
+# --- runtime -------------------------------------------------------------------------------------------
+FROM eclipse-temurin:21-jre
+# ffmpeg/ffprobe are required by the media pipeline.
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends ffmpeg \
+    && rm -rf /var/lib/apt/lists/*
+
+# Run as a non-root user.
+RUN useradd --system --create-home --uid 10001 appuser
+WORKDIR /app
+COPY --from=build /build/app.jar /app/app.jar
+USER appuser
+
+EXPOSE 8080
+# Bind to loopback by default; override SERVER_ADDRESS for a real deployment behind a proxy.
+ENV SERVER_ADDRESS=0.0.0.0
+ENTRYPOINT ["java", "-jar", "/app/app.jar"]